Liveness and readiness probes configured for all Deployments
Why it matters
Without liveness and readiness probes, Kubernetes has no signal about whether your application is healthy — it routes traffic to pods that are stuck in initialization, deadlocked, or silently broken, and it never restarts containers that have reached a bad state without crashing (CIS Kubernetes 5.5.1). Probes with unrealistic thresholds (timeoutSeconds exceeding periodSeconds) guarantee probes always fail, defeating their purpose. A missing readiness probe means traffic arrives before the application finishes startup, producing a burst of 502 errors that users experience as downtime.
Severity rationale
Low because missing probes degrade availability and mask application failures, but do not directly expose data or allow unauthorized access.
Remediation
Add both livenessProbe and readinessProbe to every container in your Deployment manifests. The liveness probe restarts unhealthy containers; the readiness probe gates traffic routing:
containers:
- name: app
livenessProbe:
httpGet:
path: /health/live
port: 8080
initialDelaySeconds: 15
periodSeconds: 15
timeoutSeconds: 3
failureThreshold: 3
readinessProbe:
httpGet:
path: /health/ready
port: 8080
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
failureThreshold: 2
Implement /health/live as a shallow ping (returns 200 if the process is alive) and /health/ready as a deeper check that verifies database connectivity and any required upstream dependencies.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Infrastructure Hardening Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · reliability.availability — Reliability / Availability
- external · CIS-Kubernetes-5.5.1 — CIS Kubernetes Benchmark §5.5.1 — Configure Image Provenance using ImagePolicyWebhook
Taxons
History
- 2026-04-18·v1.0.0·Initial import from infrastructure-hardening·automated